WordPress Core upgrade race condition flaw actively exploited, CISA says

What happened

CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3, 2026, citing evidence of active exploitation of a WordPress Core flaw. The vulnerability is a Time-of-check Time-of-use (TOCTOU) race condition caused by predictable, web-accessible staging paths used during full-package core upgrades. Patches were released in late October, and CISA's catalog entry points to the WordPress 7.1.4 release.

Wordfence, which disclosed details of the flaw in late October, said exploitation does not require an account on the site but does depend on hitting a brief window during a complete Core update. In the first 21 hours after public disclosure, Wordfence recorded more than 18,500 requests targeting staged setup-config.php installer paths. The Hacker News reported that 12,632 attacks attempting to exploit the flaw were blocked in the 24 hours before its November 4 article.

Telemetry from Previdian shows three exploitation attempts against its honeypot sensors from an IP address geolocated in the U.K. Those events were observed on October 30, 2026.

Why it matters

This is a high-severity flaw (CVSS 8.1) that allows remote code execution without requiring an account on the target site. The attack window is narrow, occurring only during the core upgrade process, but the scale of scanning is significant. With more than 18,500 requests aimed at the staged installer paths in less than a day, attackers are actively looking for servers caught in the middle of an update. Federal Civilian Executive Branch agencies must apply the fixes by November 6, 2026.

Who is affected

• WordPress Core versions 4.7 through 7.1.3, except branch releases that carry the backported fix (for example 7.0.8, 6.9.11 or 4.7.39)
• Sites that run full-package core upgrades, since the flaw sits in the staging paths those upgrades use

What to do now

1. Update WordPress Core to 7.1.4 immediately. Sites on older branches should move to that branch's patched release, such as 7.0.8 or 6.9.11; Wordfence lists fixed versions back to 4.7.39.
2. Monitor web server logs for requests targeting staged setup-config.php installer paths.
3. Audit file systems for unauthorized files created during recent core upgrade windows.

What we don't know yet

• How many sites have been successfully compromised.
• Who is behind the exploitation attempts.
• Whether ransomware groups are using the flaw. CISA lists known ransomware use as unknown.